AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793620241)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793620241 advisory. - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic...

DEBIAN-CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

UBUNTU-CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

EUVD-2026-111532

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110879: FasterXML jackson-databind: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

SUSE CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54393 PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

EUVD-2023-60623

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in the LoginPacket JSON parsing logic, caused by improper validation in the JsonMapper dependency. An unauthenticated attacker can send malformed JSON structures within a LoginPacket to crash the server . The CVSS v3.1...

CVE-2023-54393 PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54393 PocketMine-MP before 4.20.5 Denial of Service via LoginPacket

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54393

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

CVE-2023-54393: Improper Input Validation

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

PT-2026-127311

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.10.0 and later tools.jackson.core:jackson-databind versions 3.0.0 and later Description An issue exists where the software validates the outer class of a class-name type ID but fails to...

PT-2026-35190

Impact Attackers can fill the body of the clientData JWT in LoginPacket with lots of junk properties, causing the server to flood warning messages, as well as wasting CPU time. This happens because the JsonMapper instance used to process the JWT body is configured to warn on unexpected properties...

The state of HTTP clients in Spring

This is a new blog post in the Road to GA series, this time exploring the new capabilities of our HTTP clients. This is also a good time to reflect on the state of HTTP clients in Spring, so we will use this opportunity to explain an important announcement: we are officially deprecating...